Joe Corall

A missing authorization issue allows forceful browsing. The module fails to sufficiently verify block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This allows an unauthenticated attacker to retrieve restricted block content, provided they can identify the machine ID of a block containing sensitive information protected by visibility restrictions.

The `islandora advanced search` submodule fails to sufficiently verify block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This flaw allows an unauthenticated attacker to perform forceful browsing to retrieve restricted block content, provided they can identify the machine ID of a block containing sensitive information protected by visibility restrictions.

A flaw exists in Drupal Islandora that allows for Cross-Site Scripting (XSS). The issue stems from insufficient sanitization of URI paths used in a custom route for attaching media to nodes. Exploitation requires an attacker to have the 'create media' permission and the ability to edit the node to which the media is attached. Islandora is an open-source digital asset management (DAM) framework that integrates with various open-source services in a distributed environment. The vulnerable component doesn't properly sanitize input during web page generation.